DA10--VA-26-00029054 - Data Loss Prevention (DLP) Infrastructure Solution - New Requirement

The Department of Veterans Affairs Technology Acquisition Center Austin intends to solicit a commercial off-the-shelf Data Loss Prevention and Data Access Governance Infrastructure Solution as a new requirement, with a Request for Information response deadline of May 14, 2026, and an anticipated formal solicitation release following market research. The procurement is set-aside for Service-Disabled Veteran-Owned Small Businesses.

The solution must support a minimum of 700,000 users across VA's hybrid IT environment, including on-premises infrastructure, cloud environments, and Microsoft 365, and must deliver integrated capabilities for data discovery and classification, activity monitoring and threat detection with automated response, role-based access controls with just-in-time access, misconfiguration remediation in SaaS and IaaS platforms, and customizable dashboards and compliance reporting. FedRAMP Moderate authorization and SOC 2, SOC 3, ISO, HIPAA, and NIAP Common Criteria certifications are mandatory. The solution must comply with VA Critical Security Controls effective July 1, 2025, support IPv6-only operations, meet TIC 3.0 requirements, and comply with generative AI requirements per Executive Orders 13960, 14319 and OMB Memorandums M-25-21, M-25-22, and M-26-04.

The contract structure includes a 12-month base period followed by four 12-month option periods, with 24/7/365 support and one-hour response time for service outages required. Contractor must migrate from the existing Varonis deployment within 90 days of award without degradation to security posture. Respondents must submit RFI responses by May 14, 2026 at 12:00 PM EST to Kevin Andujar at Kevin.Andujar@va.gov, including detailed Bill of Materials with pricing, Compliance Matrix assessment, and transition plan if proposing an alternative to Varonis.